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LATEIT  FAILUIES  AID  COVEAAGE  II  FAULT-TOLEIAMT  SYSTEMS 
Hassaneln  H.  ta«r  and  Edward  J.  HcCluakey 
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ABSTIACT 


A  aathod  is  presented  to  include  the  affects  of 
latent  failures  in  the  coverage  parameter 
calculation  for  fault-tolorant  systems.  Programs 
for  estimating  the  reliability  of  faultn-tolerant 
systems  do  not  explicitly  take  into  account  the 
effect  of  latent  failures  in  the  hardware  recovery 
mechanism.  This  paper  shows  how  to  incorporate 
these  failures  in  the  fault-hsndling  (coverage) 
model  of  CARE  III.  The  method  presented  produces 
an  excellent  estimate  of  the  reliability  of  the 
fault-tolerant  system  when  incorporated  into  CARE 
III. 


1  IITIODUCTIOI 


Analytical  models  have  been  developed  to 
estimate  the  reliability  of  computer  systems. 
These  models  can  be  applied  to  a  large  class  of 
fault-tolerant  systems  [Bavuso  84]  (Bridgman  84]. 
The  user  must  oalculate  the  required  parameters  for 
these  awdels.  One  of  these  parameters  is  the 
moeerage,  the  conditional  probability  of 
successful  error  recovery  given  that  an  error  has 
occurred  ( Borg er son  751  (Bourlclus  71].  Error 
recovery  consists  of  error  detection.  Isolation  and 
system  reconfiguration.  The  sensitivity  of 
reliability  to  a  small  error  in  the  coverage 
estimation  is  well  known  (Arnold  72].  The 
reliability  of  the  hardware  responsible  for  the 
error  recovery  must  be  taken  into  account  (Losq 
751. 

CARE  III  is  a  well-known  automated  reliability 
model.  It  has  a  separata  model  for  the  coverage  in 
which  it  is  assumed  that  the  isolation  of  a 
detected  error  and  the  recovery  from  it  will  always 
be  successful  (Bavuso  84]  (Trivedl  81].  Thus,  the 
coverage  model  in  CARE  III  takes  only  error 
detection  into  aocount.  Furthermore,  CARE  III  does 
not  explicitly  model  latent  faults  in  hardware 
recovery  machanlsas.  Latent  faults  are  faults  that 
will  not  generate  errors  until  another  fault  occurs 
(Siewiorek  82]. 

In  (Amar  86a],  a  stand-by  spare  system  was 
designed.  The  system  had  a  hardware  recovery 
mechanism.  The  faults  were  analyzed  and  classified 
to  point  out  the  difficulties  encountered  in  the 
calculation  of  the  coverage  parameters.  The  fault¬ 
handling  (coverage)  model  of  CARE  III  had  to  be 
used  twice:  once  for  the  latent  faults  in  the 
recovery  meehaniam  and  once  for  the  other  faults  in 
the  system  (active  module,  stand-by  nodule  and 
recovery  nechanlan). 

In  this  paper,  the  circuit  presented  in  (Aner 
86s]  is  modified.  The  hardware  recovery  nechanlan 


systematically  exercises  each  of  the  two  modules 
l.e.  both  modules  are  interchangeably  connected  to 
the  system  bus.  The  faults  are  classified  and  It 
is  shown  how  to  include  the  faults  in  the  hardware 
recovery  mechanism  in  the  coverage  model  of  CARE 
III.  As  In  [Amer  86a],  the  reliability  estimate 
obtained  from  CARE  III  is  conservative  when 
compared  to  an  estimate  obtained  from  a  model 
specific  to  the  system. 

It  Is  then  shown  that  a  simplified  version  of 
the  CARE  III  coverage  model  produces  a  reliability 
estimate  that  is  identical  to  that  obtained  from  a 
model  specific  to  the  system  under  study.  It  Is 
conjectured  that  the  computer  roudoff  error  is 
responsible  for  the  difference  between  the 
estimates  obtained  from  the  original  and  simplified 
coverage  models.  Since  the  system  being  analyzed 
is  very  simple,  the  Interarrlval  time  between 
failures  will  be  much  longer  than  the  time  needed 
to  recover  from  a  failure.  Therefore,  it  Is 
reasonable  to  neglect  the  recovery  time  in  the 
fault-handling  (coverage)  model  of  CARE  III. 

In  Sec.  2,  the  system  is  described.  The  faults 
are  divided  into  different  classes  and  some 
examples  are  given  to  show  the  effect  of  the  faults 
in  the  recovery  mechanism  on  the  reliability  of  the 
system.  Only  permanent  faults  are  modeled.  In 
Sec.  3>  a  reliability  model  is  developed  that  is 
specific  to  the  system  under  study.  In  Sec.  U,  the 
coverage  parameters  and  the  reliability  of  the 
system  are  calculated  using  the  models  in  CARE  III. 
Special  attention  is  given  to  the  calculation  of 
the  coverage  parameter  "c"  or  the  probability  of  a 
failure  not  being  lethal  to  the  system  [Bavuso  84]. 
The  reliability  calculated  using  CARE  III  is  then 
compared  to  a  reliability  prediction  obtained  from 
the  Harkov  model  described  in  Sec.  3.  It  is  shown 
that  the  CARE  III  models  produce  a  conservative 
estimate  of  reliability.  In  See.  5,  the  fault- 
handling  (coverage)  model  in  CARE  III  is  modified 
to  eliminate  the  parameters  and  states  involving 
recovery  time.  The  reliability  estimate  obtained 
using  the  simplified  model  is  identical  to  the  one 
obtained  when  using  the  specific  model. 


2  THE  FAULT-TOLERANT  SYSTEM 


The  function  of  the  system  Is  equivalent  to 
that  of  a  2-lnput  OR  gate.  Figure  1  shows  the 
fault-tolerant  system.  It  has  two  inputs:  Bus-1 
and  Bus-2.  There  are  two  identical  outputs:  Bus- 
out-1  and  Bus-out-2.  The  system  consists  of  two 
identical  nodules  (X  and  Y).  Module  X  consists  of 
an  OR  gate  and  a  HAND  gate  with  two  Inverted 
Inputs.  In  the  fault-free  situation,  the  outputs 
of  the  OR  and  HAND  gates  are  identical.  The  NAND 
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gat#  ia  raduadant  and  la  usad  for  arror  detection 
within  the  aodula.  An  EXCLUSIVE-OR  gate  (the 
detector)  ooaparaa  the  outputs  of  the  OR  and  HAND 
gates  to  dateet  any  arror.  lha  output  of  the  OR 
and  NAND  gates  are  eonnaotad  to  the  bus  through  two 
buffers  with  3-atata  outputs.  Nodule  Y  is 
identical  to  nodule  X.  The  switch  (in  each  nodule) 
is  inplenented  by  an  OR  gate,  a  0  latch  and  two 
gates  to  control  the  buffers.  Initially,  the  0 
latches  are  reset  (Q,«0  and  QyiO).  The  buffers  are 
oontrolled  by  the  states  of  the  two  latches  and  by 
the  logic  value  of  the  signal  on  Bus-1  (one  of  the 
Inputs).  In  the  fault  free  situation,  Q,  and  Qy 
are  both  equal  to  0.  Nodule  X  will  be  connected  to 
the  bus  when  the  signal  on  Bus-1  has  a  logic  value 
0  and  nodule  T  will  be  connected  to  the  bus  when 
the  value  of  the  signal  on  Bus-1  is  a  logic  1. 
This  way,  nodules  X  and  T  will  be  systematically 
exercised  (or  "flexed").  If  an  error  is  detected 
in  one  of  the  two  nodules,  this  nodule  is 
pemanently  disconnected  fron  the  system  bus.  If 
the  EXCLUSIVE-OR  gate  in  module  X,  for  example, 
detects  a  discrepancy  between  the  outputs  of  the  OR 
and  NAND  gates,  the  latch  toggles,  module  X  is 
permanently  disconnected  from  the  bus  and  module  T 
is  permanently  connected  to  it. 
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Fig.  I  FeuU-lolerent  Syttem 


For  thla  aysten,  the  recovery  nechanlan  is  more 
eonplex  than  the  redundant  nodulea  that  implenent 
the  OR  function.  A  more  realistic  system  would 
have  two  complex  funotiona  (with  a  large  nvaber  of 
gates)  Instead  of  the  OR  and  NAND  gates.  However, 
it  was  decided  to  enalyxe  the  system  in  Fig.  1  for 
its  simplicity.  Furthermore,  the  system  could  be 


made  nore  reliable  by  having  two  redundant  switches 
as  in  the  Bus  Guardians  of  the  FTHP  [Hopkins  78]. 
The  emphasis  in  this  paper  is  on  the  calculation  of 
the  parameters  necessary  for  the  reliability 
models,  not  on  the  design  of  reliable  systems. 

The  fault  model  used  in  this  analysis  will  be 
the  permanent  single  stuck-at  fault  model.  The 
effect  of  temporary  failures  on  the  system  in 
Fig.  1  is  discussed  in  [Amer  86b].  The  faults  are 
divided  into  five  classes  in  order  to  calculate  the 
coverage  parameters.  Three  of  these  classes 
correspond  to  faults  in  modules  X  and  Y: 

1)  Undetectable  faults:  Since  a  fault  in  lead  A 
(input  from  Bus-1)  for  example,  will  have  the  same 
effect  on  both  inputs  of  the  EXCLUSIVE-OR  gate,  it 
is  undetectable  and  the  system  fails  (incorrect 
data  on  the  output  bus).  An  undetectable  fault 
will  only  cause,  a  system  failure  if  it  occurs  in  a 
nodule  connected  to  the  bus  at  the  time  of  the 
fault. 

2)  Dataetmbla  faults:  A  fault  in  lead  E  (input  to 
NAND  gate),  for  example,  will  only  affect  one  of 
the  Inputs  of  the  EXCLUSIVE-OR  gate.  It  will  be 
detected  and  the  switch  will  permanently  disconnect 
module  X  from  the  bus  and  connect  module  Y. 

3)  Fatal  faults:  C  s-a-0  (output  of  primary 
buffer),  for  example,  can  (if  C  should  be  1)  force 
incorrect  data  on  the  output  bus  and  the  system 
will  immediately  fall,  irrespective  of  which  module 
(X  or  Y)  is  connected  to  the  bus  at  the  time  of  the 
fault. 

Two  fault  classes  need  to  be  defined  for  the 
recovery  mechanism: 

A)  Faults  eauaing  pranatura  awitehiag:  J  s-a-i 
(detector  output),  for  example,  will  cause  module  X 
to  be  permanently  disconnected  from  the  bus  even 
though  it  (module  X)  is  fault-free. 

5)  Lataat  faults:  A  latent  fault  in  the  detector 
or  switch  will  not  produce  an  error  until  a  fault 
occurs  in  the  module  they  arc  connected  to.  J  s-a- 
0  (detector  output),  for  example,  will  not  produce 
an  error  until  the  EXCLUSIVE-OR  gate  detects  an 
error  in  module  X. 

Table  1  Fault  Classification 
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Latmt  fault*  and  faults  eauslnt  prenature 
swltehlnc  are  Identloal  to  the  "unsafe*  and  "safe” 
faults  deserlbed  In  [Losq  75l>  There  are  also 
fatal  faulta  in  the  switch.  If  lead  R  (prinary 
buffer  enable  si(nal)  is  s-a>0(  for  esanple,  both 
■odulea  (X  and  T)  will  be  disoonneoted  fro«  the  bus 
(when  the  lo(io  value  of  the  signal  on  Bus-1  ■  0) 
and  the  systea  will  fail. 

The  fault  olassifieation  is  shown  in  Table  t. 
Only  the  faults  in  nodule  X  and  the  detector  and 
switch  connected  to  it,  are  ahown.  The 
classification  of  the  faults  in  nodule  Y  and  the 
detector  and  switch  connected  to  it  is  identical  to 
that  shown  in  Table  1.  The  faults  are  divided  into 
eight  groups.  Each  row  in  Table  1  corresponds  to  a 
group  and  each  group  corresponds  to  one  of  the 
classes  described  above.  More  than  one  group  can 
belong  to  the  sane  class.  Croups  3  and  7,  for 
exanple,  both  consist  of  fatal  faults.  The  total 
ntsiber  of  faults  in  group  i  is  equal  to  WCi]. 

3  lELIiBILITT  CALCULATIOM  USING 
A  SPECIFIC  MODEL 

Figure  2  shows  the  Markov  nodel  used  to 
calculate  the  reliability  of  the  syaten  under 
study.  This  nodel  takes  into  account  the  order  in 
which  the  different  faults  occur.  It  is  assumed 
that  the  failure  rate  of  any  gat*  or  latch  in  the 
systen  is  equal  to  2z  and  that  the  stuck-at-0  and 
stuek-at-1  faulta  are  equally  likely  (each  with  a 
failure  rat*  of  z) .  Assuning  also  that  all  holding 
tines  (tinea  spent  in  each  state)  are  exponentially 
distributed,  the  transition  rates  will  be  the  sun 
of  the  appropriate  Vti]'s  nultiplied  by  z  (see 
Table  1).  Solving  the  Markov  nodel,  the  systen 
unreliability  is  obtained  as  follows  [Trivedi  62]  i 

Unr*liability(t)  t  p  (Systea  failure  at  tin*  t) 


unreliability  when  calculated  using  CARE  III  (see 
Secs.  4  and  5) . 


Unreliability  x  10*' 


0  -  ■  y  CARE  III  (simplified)  & 

model  specific  to  system 

—  f - 1 - 1 - 1 - ► 

1000  2000  3000  4000  time 

(hours) 

Fig.  3  System  Unreliability  Calculated  Using 
Model  Specific  to  System.  Original  and 
Simplified  CARE  III  Coverage  Model 


xx(W(11  +  (2xZWliI)) 
I-  2. 3.  7 

Fig.  2  Reliability  model  specific  to  system  in  Fig.  1 


In  Fig.  3,  the  unreliability  is  plotted  (for  z 
•  1  FIT  «  1  failure/ 10°  hours)  along  with  the 


Fig.  4  CARE  III  Coverage  Model 


4  lELIABILITT  CALCULATION  USING  CARE  III 

In  this  section,  the  fault  classtflcation 
presented  in  Sec.  2  is  used  to  determine  the 
paraneters  for  the  fault-handling  (coverage)  model 
of  CARE  III.  CARE  III  is  a  very  sophisticated 
"autonated  reliability  nodel"  [Bridgman  84].  It 
can  be  divided  into  two  parts  :  the  aggregate  model 
and  the  fault-handling  (coverage)  model.  The 
latter  describes  the  recovery  process  in  detail. 
More  information  about  CARE  ill  can  be  found  In 
[Bavuso  84],  (Trivedi  81).  Figure  4  shows  the 
single  fault-handling  nodel.  A  fault  (with  rate 
f(t))  causes  the  system  being  modeled  to  go  to 
state  A.  The  fault  is  active  but  no  error  exists 
yet.  The  fault  produces  an  error  (at  a  rate  r(t')) 
and  the  system  goes  from  state  A  to  state  A^.  If 
the  error  is  not  fatal,  the  systen  will  go  to  state 
Aq  (  at  a  rat*  E(t")  and  with  a  conditional 
probability  c) .  If  the  error  is  fatal,  the  systen 
will  go  to  state  F.  Both  t'  and  t"  are  random 
variables.  It  is  assumed  here  that  they  are 


distributtd  txponmtlally.  1/r(t')  is  the  avtrage 
tlae  for  a  fault  to  produea  an  arror  and  1/E(t*)  Is 
tha  avaraga  tlaa  for  that  arror  to  ba  datactad  (or 
causa  a  aystaa  faiXura).  State  Aq  indicates  that 
the  arror  uaa  datactad;  it  ia  assisiad  in  CARE  III 
that  the  isolation  of  the  arror  and  the  recovery 
froai  it  will  always  ba  successful. 

Only  paraanant  faults  are  considered  here.  Ihe 
fault-handling  aodel  should  be  able  to  represent 
all  the  faults  in  the  1-out-of-R  systen  under 
study.  A  latent  fault  (J  a-s-0  for  exaaple)  will 
only  affect  the  systaa  after  an  arror  in  nodule  X. 
The  paraneter  t*  (tine  for  fault  to  produce  an 
error)  will  be  many  orders  of  nagnitude  larger  than 
that  of  a  detectable  fault  in  nodule  X.  Therefore, 
the  latent  faults  cannot  be  handled  like  the  other 
faults.  The  systen  could  be  divided  into  two 
subsystens:  Modules  X  and  T  and  the  recovery 

nechanisn.  The  double  fault-handling  nodel  in  CARE 
III  r^^vuso  8A]  can  be  used  to  describe  the 
depk.u-  ■  between  the  faults  in  the  two 
subsyscens. 


faults  in  the  systen  into  latent  and  non-latent  Is 
the  best  way  of  including  the  faults  in  the 
hardware  recovery  nechanisn  in  the  coverage  model 
of  CARE  III. 

In  Fig.  5,  the  fault-handling  nodel  Is  applied 
to  the  faults  in  nodules  X  and  Y  as  well  as  the 
non-latent  faults  in  the  recovery  nechanisn.  The 
paraneter  c  (probability  that  the  system  can 
recover  fron  the  error)  is  estimated  as  the  ratio 
of  the  faults  that  are  not  fatal  to  the  total 
nviBber  of  non-latent  faults. 

Sun  W[l]  irI.S.S 

c  s  - - — — - - 

Sum  Wti]  1x1, 2, 3. 5. 7. B 

Since  the  system  is  very  simple  and  the  clock 
cycle  is  many  orders  of  nagnitude  smaller  than  the 
nean  time  between  faults,  the  parameters  r(t')  and 
Eif)  are  both  assuned  to  be  large  and  constant. 


Fig,  7  Simplilied  coverage  rhodel 
(or  non-latent  faults 


^  ■  Fault-free  State 


Fig.  5  CARE  III  with  Non-latent  Faults 
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Fig.  8  Simplified  coverage  model 
for  latent  faults 

Rg.  6  CARE  III  with  Latent  Faults 

The  latent  faults  in  the  recovery  mechanism  are 
treated  separately  as  shown  in  Fig.  6.  The 
paraneter  c,  in  this  case,  is  equal  to  zero  because 
any  fault  in  a  module  whose  recovery  mechanism  is 

However,  it  will  be  impossible  to  distinguish  the  disabled,  will  lead  to  a  system  failure.  E(t”)  is 

latent  faults  fron  the  rest  of  the  faults  in  the  assigned  a  large  constant  while  r(t')  is  equal  to 

recovery  nechanisn.  A  solution  for  this  problen  is  the  sun  of  the  failure  rates  of  the  non-latent 

to  divide  the  faults  in  the  systen  into  two  types:  faults  in  the  system.  The  reliability  is 

1)  Latent  faults.  2)  All  other  faults  in  the  calculated  as  follows  [Trivedi  81]: 
systen  (non-latent  faults).  Hence,  the  fault¬ 
handling  nodel  has  to  be  used  twice.  Dividing  the  Reliabillty( t)  z  1-P(belng  in  state  F  at  time  c) 


coverage  model. 


The  reliability  of  the  whole  aystem  will  be  the 
product  of  the  reliabilities  calculated  from  the 
above  two  models  (Figs.  S  and  6).  The 

unreliability  is  shown  in  Fig.  3  for  i  *  1  FIT  IMll 
g2].  It  is  conservative  when  compared  to  the 
unreliability  obtained  from  the  Harkov  model 
spec  if  io  to  the  system  (Fig.  2). 

5  SIMPLIFIED  FAULT-UIDLISG  (COVEIAGE)  MODEL 

In  the  fault>handling  (coverage)  model  shown  in 
Fig.  5,  the  parameters  r(t')  and  E(t")  were  both 

assvned  to  be  large  and  constant,  r(t')  being  the 
rate  at  which  a  fault  causes  an  error,  it  will  be 
many  orders  of  magnlti^e  greater  than  the  failure 
rate  (l  *  1  FIT  »  1/10®  hours).  Therefore,  it  can 
safely  be  assuaed  that  the  transition  between 
states  A  and  in  Fig.  5  is  instantaneous.  The 
same  argtnent  applies  to  Elf).  Figure  7  shows  a 
simplified  coverage  model  for  the  non-latent 

faults.  The  parameters  r(t')  and  E(t'')  are 

eliminated.  Figure  8  shows  a  simplified  coverage 
model  for  the  latent  faults.  State  A£  is 
eliminated  because  errors  will  Instantaneously 

cause  a  system  failure.  Using  the  same  parameters 
as  in  Sec.  4,  the  models  shown  in  Figs.  7  and  8  are 
solved.  It  is  found  that  the  reliability  estimate 
obtained  is  identical  to  the  one  obtained  using  the 
specific  model  described  in  Sec.  3  (see  Fig.  3)> 
It  is  conjectured  that  the  difference  between  the 
two  reliability  estimates  shown  in  Fig.  3  is  due  to 
the  computer  roundoff  error.  In  conclusion, 
dividing  the  faults  in  the  system  into  latent  and 
non-latent  and  including  the  non-latent  faults  in 
the  recovery  mechanism  with  the  faults  in  nodules  X 
and  Y  produces  an  eicellent  estimate  of  the  system 
reliability. 

6  SUMMAIT  and  COECLUSIOMS 

A  very  simple  redundant  system  was  designed. 
It  consists  of  two  identical  modules  that  are 
interchangeably  connected  to  the  system  bus.  The 
recovery  mechanism  consists  of  a  detector  and  a 
switch  for  each  module.  The  faults  were  divided 
into  five  classes  assuming  a  aingle  atuck-at  fault 
model.  The  five  fault  classes  were  then  used  to 
determine  the  coverage  parameters  for  the  fault¬ 
handling  model  in  CARE  III.  Even  though  only  one 
type  of  fault  (permanent)  was  modeled,  the  fault¬ 
handling  (coverage)  model  had  to  be  used  twice  to 
account  for  the  latent  faults  in  the  recovery 
mechanism.  Each  time  the  model  was  used,  a 
different  set  of  coverage  parameters  was 
calculated. 

A  reliability  model  specific  to  the  system  was 
also  developed  and  the  results  were  compared  to 
those  obtained  with  the  models  in  CARE  III.  It  was 
found  that  CARE  III  gives  a  conservative  estimate 
of  the  reliability  of  the  system. 

Finally,  the  fault-handling  (coverage)  model  of 
CARE  III  was  simplified.  It  was  then  used  to 
calculate  the  reliability  of  the  system  and  it  was 
found  that  the  estimate  obtained  was  identleal  to 
the  one  obtained  from  the  Harkov  model  specific  to 
the  system.  It  was  conjectured  that  the  computer 
roundoff  error  was  responsible  for  the  conservative 
estimate  obtained  from  the  original  (unmodified) 
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ABSTRACT 

This  paper  describes  a  new  design  technioue  for  fuUy- 
tesuble  CMOS  combinational  circuits  and  a  3-pattem  test 
scheme  to  detect  switch-level  (stuck-open  and  stuck-on) 
faults.  A  fiilly-testable  combinational  circuit  is 
implemented  with  specially  designed  gates  diat  have  no 
undstecuble  stuck-on  faults.  Switch-level  faults  in  this 
type  of  combinational  dreuit  can  be  delected  with  a  3- 
pattem  test  scheme.  These  3-pattem  tests  are  easy  to 
generate  with  a  gate-level  automatic  test  pattern  generator 
(ATPG)  that  offers  better  performance  than  a  switch-level 
ATPG. 


1  INTRODUCTION 

CMOS  circuits  possess  certain  unioue  failure  modes 
that  caimot  be  detects  by  a  stuck-at  fault  lest  set  These 
failure  modes  are  better  modeled  at  the  transistor  circuit  or 
the  switch  level  as  FET  stuck-open  faults  and  FET  stuck-on 
faults  [Wadsack  78]. 

A  stuckropen  fault  requires  a  sequence  of  two 
consecutive  paoems  to  guarantee  detection.  However, 
these  2-pattem  tests  can  potentially  be  invalidated  by 
stray  circuit  delays  [Reddy  83].  The  algorithm  to  generate 
valid  robust  2-patteni  tests  is  compuutionally  complex. 
It  has  been  reported  that  a  switch-level,  stuck-epen  fault 
ATPG  may  require  an  order  of  magnitude  more  CPU  time  to 
generate  tests  than  a  gate-level,  stuck-at  fault  ATPG,  and  it 
can  only  achieve  stuck-open  fault  coverage  of  up  to  70% 
on  large  ICs  [Moritz  86]. 

A  stuck-on  fault  presents  a  different  testing  problem. 
Consider  the  logic  gate  shown  in  Fig.  1.  The  lest  pattern 
that  should  detect  FET  N2  stuck  on  is  (1,  0,  1,  0). 
However,  this  input  combination  creates  a  short  between 
Vdd  and  ground  within  the  faulty  gate.  If  the  circuit  is  P- 
dominant  (Le.  the  transconductance  of  every  PFET  is  much 
larger  than  every  NFET),  then  the  voltage  level  at  output 
node  Z  will  be  close  to  5  volts.  In  thu  case,  the  faulty 
gate  output  will  be  recognized  u  the  tame  as  the  fault-free 
gate  ou^t  and  the  fault  is  mt  detected.  These 
undetectable  faults  are  difTicult  to  identify  and  should  be 
removed  from  the  fault  list  [Lusky85]  reported  that  the 
presence  of  undetectable  stuck-on  faults  in  a  CMOS  VLSI 
circuit  will  substantially  slow  down  switch-level  ATPG  and 
fault  simulatioo  programs. 

Due  to  the  difficulty  of  testing  for  switch-level  faults 
in  conventional  CMOS  circuits,  design  for  testability 
(DFT)  techniques  were  proposed  to  offer  circuit  structures 
which  have  better  teslabili^  for  switch-level  faultt.  [Jha 
8S;  McCluskey  81;  Reddy  83]  proposed  testeble  desi^ 
methods  to  facilitate  the  detection  or  stuck-open  faults  m 
a  single  logic  gate.  Stuck-oo  fault  testabiliiy  was  not 
addressed.  [Zasio  85]  described  a  layout  method  (o 
decrease  the  mbability  of  stuck-open  fault  occurrence  in 
gate  array  chips,  but  his  method  cani»t  be  generalized  to 
custom  VLSI  circuits.  [Brxozowski  85]  presented  a  testable 

a  design  method  for  both  stuck-open  and  soick-on 
.  However,  the  method  caimot  be  easily  extended  to 


Figure  1.  An  FCMOS  gate  exanqile. 


a  combinational  circuit  consisting  of  interconnections  of 
testable  gates.  [Malaiya  82]  proposed  a  current 
monitoring  technique  to  detect  stuck-on  faults. 
Nonetheless,  this  teeWque  will  slow  down  functional  test 
substantially  and  prohibits  the  use  of  dynamic  circuit 
structures  that  draw  steady-state  cunent 

This  paper  describes  a  new  CMOS  circuit  design 
technique  for  switch-level  testability.  The  technique 
considers  both  the  stuck-open  fault  and  the  stuck-on  fault. 
It  creates  testable  combmational  circuits  for  which  a 
conventional  gate-level  ATPG  can  generate  tests. 

2  TESTABLE  DESIGN  TECHNIQUES 
A  CMOS  combinational  circuit  consists  of  various 
types  of  logic  gates:  primitive  gates  (e.g.  inverter,  NAND, 
NOR)  and  conqilex  gates  (e.g.  AOI  gat^  OAl  gate).  Most 
logic  gates  have  the  following  properties:  (1)  each  logic 

Sate  iiyut  is  coimected  to  the  transistor  gate  terminals  of 
oth  a  PFET  and  an  NFET,  and  (2)  the  pull-up  network 
provides  conduction  paths  for  all  input  combinations  for 
which  the  output  node  is  one;  ttie  pull-down  network 
provides  conduction  paths  for  all  input  combinations  for 
which  the  output  node  is  zero.  These  gates  will  be  referred 
to  as  Fully  Complementary  MOS  (FCMOS)  gates  in  this 
paper.  The  logic  gate  of  Fig.  1  is  an  example  of  FCMOS 
gates.  Gates  that  are  not  FCMOS  gates  are  often  used  as 
I/O  buffers  and  in  busses,  and  examples  of  these  gates  can 
be  found  in  [Reddy  84]. 


2.1  Ctaxult  design  for  stuck-open  fault  testability 

This  subsection  summarizes  a  circuit  structure  and  its 
test  scheme  presented  in  [Liu  86a]. 

Detecting  a  stuck-open  fault  in  an  FCMOS  gate 
requires  two  patterns.  The  first  pattern  (initialuing  input) 
is  applied  to  charge  or  discharge  the  gate  output,  and  the 
second  pattern  (test  ir^ut)  is  mlied  to  chaitge  the  value 
of  the  output  node  through  the  faulty  FET.  A  simplified  2- 


patten)  test  which  uses  either  an  all-one  or  an  all-zero 
pattern  as  the  first  input  pattern  is  easier  to  generate  than 
other  2-pattein  tests.  These  simplified  patterns  were 
proved  to  be  valid  under  stray  circuit  delays. 

To  apply  simplified  patterns  to  an  embedded  FCMOS 
gate,  the  combinational  circuit  must  be  implemented  u 
shown  in  Fig.  2.  In  this  figure,  an  inverting  buffer  is 
added  to  every  FCMOS  gate  which  drives  other  FCMOS 
gate(s).  If  all  the  prim^  input  literals  (x  and  x*)  are  set 
to  zero,  then  all  or  its  rcMOS  gate  inpu's  are  initialized 
to  zero;  if  all  the  prima^  inputs  are  set  to  one,  then  all 
of  its  FCMOS  gate  inputs  are  initialized  to  one. 
Therefore,  it  is  straightforward  to  generate  the  first  input 
p^ro  for  simplified  2-pattern  testing  of  any  embedded 


Figure  2.  Block  diagram  of  a  testable  circuit. 


2.2  Circuit  design  for  stuck-on  fault  testability 

The  following  definitions  describe  a  logic  gale 
structure  in  which  every  stuck-on  fault  in  the  pull-up  and 
the  pull-down  networks  is  detectable. 

Definition:  A  Stuok-On  Fault  Testable  (SOFT)  gate  is 
constructed  by  adding  two  FETs  (blocking  FETs)  and  two 
input  lines  to  an  FCMOS  gate,  Fig.  3(a).  FET  Pb 
connects  Vdd  to  the  pull-up  network  and  FET  Nb  connects 
^und  to  the  pull-down  network.  Input  line  Cp'  controls 
FET  Pb  and  input  line  Cn  controls  FET  Nb. 


(a)  (b) 


Figure  3.  A  stuck-on  fault  testable  gate. 

(a)  Block  diagram,  (b)  An  example. 


Definition:  The  input  lines  to  the  pull-up  and  pull-down 
Mtwork  of  a  SOFT  gate  are  called  Junctional  inputs.  Input 
lines  Cp'  and  Cn  of  a  i^FT  gate  are  called  control  inputs. 
During  normal  operation,  control  input  Cp'  is  set  to  zero 


and  Cn  is  set  to  one.  _ 

With  the  addition  of  blocking  FETs,  every  stuck-on 
fault  in  the  puU-down  and  pull-up  network  of  a  SOFT  gate 
is  detectable  by  a  pair  of  test  patterns.  (Stuck-on  faults  in 
blocking  FETs  require  a  special  testing  technique,  and  will 
be  discussed  in  Section  3)  First,  an  input  pattern  is 
applied  to  the  SOFT  gate  to  provoke  the  stuck-on  fault  and 
(mpagate  its  faulty  effect  (an  intermediate  voltage  level) 
to  the  ouq>ut  node.  Second,  an  input  pattern  is  applied  to 
de-activate  one  of  the  blocking  FETs  which  breaks  the 
short  between  Vdd  and  ground.  The  ouq>ut  node  will  then 
be  charged  or  discharged  to  a  faulty  value  through  the 
stuck-on  FET  and  the  fault  is  thus  detect^. 

Example  1:  If  FET  N2  in  Fig.  3(b)  is  stuck-on,  find  a 
pair  of  test  patterns  for  this  fault 

The  following  input  patterns  can  detect  the  stuck-on 
fault  in  FET  N2; 

»',  Cn,  A,  B,  C.  D)}  - 

1,0,1,0),  (1,1,1,0,1,0)}. 

The  first  input  pattern  creates  a  short  in  the  faulty  SOFT 
gate  but  not  in  the  fault-free  gate,  and  sets  the  output  node 
to  an  intermediate  voltage  level  (x).  The  second  pattern 
turns  FET  Pb  off  and  discharges  the  faulty  gate  output  to 
zero.  However,  the  fault-free  gate  output  node  is  at  a  high- 
impedance  state  and  will  remain  at  one.  Therefore,  the 
shick-on  fault  is  detected. 

A  combinational  circuit  can  be  constructed  by 
interconnecting  SOFT  gates.  However,  this  presents  a 
problem  when  testing  for  stuck-on  faults.  In  Fig.  4, 
assume  a  stuck-on  fault  exists  in  the  pull-down  network  of 
SOFT  gate  A.  Applying  a  pair  of  test  patterns  to  this 
logic  gate  will  force  the  output  node  U  to  change  from  an 
intermediate  voltage  (x)  to  zero  because  the  second  pattern 
will  set  Cp'  to  one.  However,  the  transition  at  node  U  (x 
to  zero)  cannot  change  the  logic  value  at  the  output  node 
V  because  the  pull-up  network  of  SOFT  gate  B  is  also 
disconnected  from  Vdd.  Therefore,  the  faulty  effect  in  gate 
A  will  not  be  propagated  through  gate  B  to  an  observable 
output 


Gate  A  Gate  B 


^  .  Xdd 

Vdd 

JjOv 

"t 

*  represents  a  stuck-on  fault. 


Figure  4.  A  cascade  of  SOFT  gates. 


An  obvious  solution  to  this  error  propagation 
problem  is  to  use  two  sets  of  Cp'  and  Cn  simals  to 
control  SOFT  gates  in  an  alternating  fashion.  However, 
this  solution  increases  wiring  complexity  and  complicates 
the  control  circuittv.  A  better  solution  is  to  add 
inverting  buffers  netween  SOFT  gates  so  that  the 
combinational  circuit  conforms  to  the  structure  shown  in 
Fig.  2  except  that  FCMOS  gates  are  replaoMl  by  SOFT 
gates.  Notice  these  inverting  buffers  do  not  include 
blocking  FETs.  Due  to  the  buffer,  gate  B  will  receive  an 
input  transition  from  x  to  one  instead  of  x  to  zero.  When 
the  second  input  pattern  is  applied  to  the  CUT,  the  control 
input  Cn  is  set  to  one  so  that  every  pull-down  network  is 
connected  to  ground.  An  x-to-one  transition  at  the  input 


VTV'r'i'v 


of  gate  B  can  propagate  to  its  output  Thus,  a  stuck-oo 
fault  in  this  circuit  structure  can  be  detected  with  a  pair  of 
patterns. 

2J  Fully  testable  circuit  structure 

In  sununaiy,  a  fully  testable  combinational  circuit 
can  be  defined  as  follows: 

Dtfu^ion:  A  fully  testable  combinational  circuit  is  a 
multi-level  co^inatioaal  circuit  which  consists  of  SOFT 
gates  and  inverting  buffers.  An  inverting  buffer  is  placed 
at  the  oumut  of  every  SOFT  gate  which  drives  another 
SOFT  gate6). 

Two  combinational  circuits  were  examined  to  evaluate 
the  impact  of  the  proposed  design  techiiique  on  circuit  area 
and  speed.  These  were  an  8-to-l  multiplexer  (MUX81H) 
and  a  4-bit  adder  (FA4)  [LSI  85].  The  average  area 
overhead  was  found  to  be  approximately  25%.  This  figure 
represents  a  worst  case  estimate  because  no  attempt  was 
m^e  to  reduce  the  overhead  ^  sharing  blocking  FtTs  or 
by  minimizing  device  sizes.  TIk  performance  impact  was 
determined  by  SPICE  simulations  using  parameters  from 
Stanford  University's  Center  for  Integrated  Systems  CMOS 
process.  The  average  critical  path  delay  of  the  two 
testable  designs  was  increased  by  15%. 

2.4  Three-pattern  testing  of  switch-level  faults 

This  subsection  discusses  how  to  combine  the  test 
patterns  for  a  stuck-open  fault  and  a  stuck-on  fault  so  that 
they  can  be  tested  by  a  sequence  of  three  test  patterns. 
Furthermore,  it  will  be  shown  that  these  3-pattem  tests 
can  be  derived  from  a  gate-level,  stuck-at  fault  ATPG. 

Test  patterns  for  detecting  switch-level  faults  in  a 
SOFT  gate  ve  shown  in  Table  1.  In  this  Uble,  both  Ta 
md  Tb  are  input  patterns  for  provoking  the  stuck-on  faults 
in  the  SOFT  gate;  Tc  and  Td  ate  input  patterns  for 
detecting  stuck-open  faulu.  For  stuck-on  fault  patterns, 
the  second  input  pattern  is  identical  to  the  first  input 
pattern  except  for  the  control  inputs.  The  second  pattern 
must  turn  off  one  of  the  blockini  FETs  so  as  to  break  the 
short  in  the  faulty  logic  gate.  The  location  of  the  stuck- 
on  fault  within  the  SOFT  gate  determines  the  input  pattern 
for  control  inputs.  For  example,  if  a  stuck-on  fault  is  in 
the  pull-down  network,  the  second  pattern  is  required  to 
set  input  Cp'  to  one  so  as  to  isolate  the  pull-up  network 
from  Vdd.  For  stuck-open  fault  patterns,  the  initializing 
input  pattern  is  similarly  determined  by  the  location  of 
the  fault  within  a  SOFT  gale.  For  example,  if  the  stuck- 
open  fault  is  in  the  pull-down  network,  an  all-zero  pattern 
is  used  for  the  functional  inputs  to  charge  the  output  node 


Next,  we  introduce  the  concept  of  duality  within  a 
SOFT  gale. 

Definition:  The  PFET  Pi  and  NFET  Ni  whose  transistor- 
gate  terminals  are  controlled  by  the  same  input  line  i  of  a 
SOFT  gale  are  called  the  associate  FETs  of  input  line  i. 
FET  Pi  is  called  the  dual  FET  of  Ni  and  vice  versa. 

Definition:  Within  a  SOFT  gate,  if  a  PFCT  Pi  has  a  stuck- 
open  fault,  its  dual  /aulr  is  defined  as  a  stuck-on  fault  in 
its  dual  FET  Ni;  similarly,  the  dual  fault  of  a  stuck-on 
PFET  Pi  is  defined  as  a  stuck-open  fault  in  the  dual  FET 
Ni. 

The  following  lemma  is  due  to  [Chiang  83]. 

Lemma  1:  (Duality)  For  an  FCMOS  gate,  the  lest  input 
pattern  for  a  stuck-open  fault  will  detect  a  stuck-on  fault  in 
Its  dual  FET  if  that  stuck-on  fault  is  detectable. 

Since  everv  stuck-on  fault  in  a  SOFT  gate  is 
dctccuble,  the  above  lemma  can  be  used  to  combine  the 
test  set  for  stuck-open  faults  with  that  for  stuck-on  faults. 
This  leads  to  the  following  corollary; 
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Table  1.  A  surmnary  of  test  patterns  for  a  SOFT  gate. 


Test  for  a  stuck-on 

fault. 

n 

Fault  in  the  PD-network 

Fault  in  the  PU-network  | 

Cp-  Cn  I 

Z 

z* 

Cp-  Cn 

I 

Z 

z* 

0  1  Ta 

1 

X 

0  1 

Tb 

0 

X 

1  1  Ta 

2^ 

0 

0  0 

Tb 

0* 

1 

1  Test  for  a  stuck-open  fault. 

1  Fault  in  the  PD-network 

Fault  in 

the  PU-networkj 

Cp'  Cn  I 

z 

z* 

Cp'  Cn 

I 

z 

z» 

0  1  alJ-0 

1 

1 

0  1 

all-1 

"o" 

0 

0  1  Tc 

0 

1* 

0  1 

Td 

1 

0* 

Z:  fault-free  output  Z*;  faulty  output 

x;  intermediate  voltage  0*:  high-impedance  0 

PU-network:  pull-up  network  1*:  high-impedance  1 
PD-network:  pull-down  network 


Corollary  1:  (Three-pattern  test)  In  a  SOFT  gate,  every 
stuck-open  fault  and  its  dual  stuck-on  fault  can  be  tested 
with  a  S-pattern  test. 

A  3^attern  test  for  a  SOFT  gate  is  shown  in 
Table  2.  TA  ud  TB  are  test  input  patterns  for  stuck-open 
faults.  The  first  two  CFl  and  T2)  patterns  will  detect  a 
smek-open  fault  and  the  last  two  (T2  and  T3)  patterns  will 
detect  the  dual  stuck-on  fault.  Only  the  T2  pattern  needs 
to  be  generated,  the  T1  and  T3  patterns  are  then  easily 
determined.  As  a  matter  of  fact,  the  T2  pattern  can  be 
generated  by  a  gate-level,  stuck-at  fault  ATPG. 


Table  2.  3-pattcrn  lesU  for  a  SOFT  gate. 


PU-network 

PD-network 

stuck-open 

stuck-on 

suick-on 

stuck-open 

Cp'  Cn  I  Z  Z* 

CpCn  I  ZZ* 

T1 

0  1  all-1  0  0 

0  1  all-0  1  1 

T2 

r  1  TA  1  0* 

0  1  TB  0  !• 

T3 

1  1  TA  1  0 

0  0  TB  0  1 

i 


1 


For  the  purpose  of  lest  generation,  a  CMOS  logic 
gate  can  be  represented  either  at  the  switch  level  or  at  the 
logic  gate  level.  For  example.  Fig.  5  shows  two  different 
representations  of  a  SOFT  gate.  Nouce  that  the  blocking 
FETs  of  a  SOFT  gate  are  ignored  when  deriving  the 
equivalrat  gate-level  representation.  Each  stuck-at  fault 
on  an  input  line  in  Fig.  5(b)  corresponds  to  two  switch- 
level  faults  in  Fig.  5(a).  Nonetheless,  there  exists  a 
correspondence  between  the  test  patterns  for  a  stuck-at 
fault  and  a  pair  of  switch-level  faults. 
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Figure  5.  A  SOFT  gate,  (a)  Switch-level  representation, 
(b)  Gate-level  representation. 


Lemma  2:  For  a  SOFT  gate,  the  test  pattern  that 
detects  an  input  line  i  stuck-at  fault  is  a  T2  pattern  for  the 
switch-level  faults  in  tte  FETs  associated  with  line  i. 

Proop  Assume  the  SOFT  gate  implements  a  Boolean 
function  r(X],  X2.— .  x^)-  If  •  stuck-at  zero  fault  exists 
on  input  line  Xj  of  the  gate-level  representation,  this  fault 
corresponds  to  a  stuck-open  fault  in  the  pull-down  network 
and  a  stuck-on  fault  in  the  pull-up  network.  The  pull-down 
network  can  be  expressed  \>y  a  transmission  Mn(xi, 

X2 .  Xp)  that  is  equivalent  to  f '.  The  T2  pattern  for  the 

stuck-open  fault  can  be  found  by  computing  the  Boolean 
difference  of  Mn,  i.e.  dMn/dxj  [McCluskey  86].  From  the 
property  of  Boolean  difference, 

dMn/dXj  »  df  '/dx;  ■  df/dxj, 

where  the  test  pattern  for  a  stuck-at  fault  on  line  Xj  can  be 
found  from  df/dx}.  Therefore,  the  stuck-at  fault  pattern  for 
line  Xj  is  the  same  as  the  T2  pattern  for  its  associated 
switch-level  faults. 

If  input  line  x;  has  a  stuck-at-one  fault,  it  will 
correspond  to  a  stuck-open  fault  in  the  pull-im  network 
and  a  stuck-on  fault  in  the  puU-down  network.  Ine  pull-up 
network  can  be  expressed  as  a  transmission  Mp(x't, 
*2>  -  *n)  •bat  is  equivalent  to  f.  However,  for  a  fully 
complementary  gale,  the  pull-up  network  is  a  dual  of  the 
pull-down  network.  Therefore 

Mp(x'i,  X2,_,  x„)-[D(Mp(xi,  X2,..,  Xn))]'  -Mn', 

where  D(M)  stands  for  the  dual  of  transmission  M. 

To  compute  the  T2  pattern  for  the  stuck-open  fault,  we 
need  to  find  the  Boolean  difference  of  Mp.  From  the 
property  of  Boolean  difference, 

dMpfx'j,  x‘2....,  x'n)/dx'i  »  dMn'/dx'j  »  df/dx'j  «  df/dxj. 

Therefore,  a  test  pattern  for  the  Xj  stuck-at  one  fault  is  the 
same  T2  pattern  for  its  associated  switch-level  faults. 

This  lemma  is  true  even  if  an  input  line  controls 
more  than  two  FETs  Deuiled  discussion  is  presented  in 
[Liu  86bj. 

Q.E.D. 

Based  upon  the  result  of  this  lemma,  a  gate-level, 
stuck-at  fault  ATPG  can  be  used  to  generate  the  T2  test 
patterns  for  switch-level  faults  in  a  SOFT  gate.  The 
ability  to  use  a  gate-level  ATPG  will  greatly  speed  up  the 
process  of  test  generation  for  CMOS  circuits. 


3  TEST  SCHEMES  FOR  ADDITIONAL  aRCLfiTRY 

The  additional  test  circuiltv  for  a  fully  testable 
combinational  circuit  consists  of  inverting  buffers  and 
blocking  FETs.  This  circuitry  must  be  checked  before  3- 
pattem  tests  can  be  used  to  detect  twitch-level  faults  in 
the  remaining  functional  circuitry.  Detecting  stuck-open 
faults  in  the  additional  circuitry  is  straightforward  and 
requires  no  additional  test  patterns.  However,  detecting 
stuck-on  faults  in  this  circuitry  is  very  difficult  with  only 
functional  test  patterns. 

It  has  been  shown  in  [Liu  86]  that  additional  test 
patterns  are  not  necessary  for  detecting  stuck-open  faults 
in  the  inverting  buffers.  A  stuck-open  fault  in  the 
blocking  FET  Nb  (Fig.  6(a))  is  equivalent  to  a  stuck-open 
fault  in  the  pull-down  network.  Because  it  is  necess^  to 
set  input  Cn  to  one  and  esublish  a  conduction  path  in  the 
pull-down  network  to  provoke  the  stuck-open  fault  in  Nb, 
this  input  pattern  can  also  detect  any  stuck-open  fault  in 
the  conduction  path.  Therefore,  if  we  generate  a  complete 
test  for  every  stuck-open  fault  in  the  pull-down  network, 
this  test  set  will  simultaneously  detect  the  stuck-open  fault 
in  FET  Nb.  Similarly,  a  stuck-open  fault  in  FET  Pb  is 
equivalent  to  a  stuck-open  fault  in  the  pull-up  network. 


Figure  6.  Test  schemes  for  additional  circuitry, 
(a)  Inverting  buffers,  (b)  Blocking  FETs. 


The  scheme  for  testing  stuck-on  faults  in  an 
inverting  buffer  is  shown  in  Fig.  6(a).  If  FET  Nib  is  stuck 
on,  we  need  to  produce  a  zero  at  the  inverting  buffer  input 
node  U  so  that  this  faulty  inverter  will  draw  a  large  supply 
current.  Node  U  can  easily  be  set  to  zero  by  applying  an 
all-one  pattern  at  the  primary  inputs  of  the  CUT.  Notice 
that  the  NFET  stuck-on  fault  in  every  inverting  buffer  can 
be  lest^  at  the  sair.e  time  by  setting  the  control  input  Cn 
to  one,  Cp'  to  zero  and  every  functional  primary  input  to 
one.  The  PFET  stuck-on  fault  in  every  inverting  buffer 
can  be  tested  similarly. 

This  current  monitoring  scheme  can  also  be  extended 
to  detect  a  stuck-on  fault  m  blocking  FETs  as  shown  in 
Fig.  6(b).  Assuming  that  two  sets  of  power  and  ground 
lines  are  used;  one  for  the  SOFT  gates  and  the  other  for 
the  inverting  buffers.  If  FET  Pb  is  stuck-on,  we  apply  a 
primary  input  patiem  which  sets  Cn  to  one,  Cp'  to  zero 
and  the  remaining  functional  inputs  to  zero.  Node  U  will 
be  set  to  one.  'Inen  control  input  Cp'  is  changed  to  one 
and  the  voltage  level  at  the  PWR  line  is  decreased  from  S 
volts  to  2.5  volts.  If  FET  Pb  is  stuck-on,  the  voltage 
level  at  node  U  will  follow  the  voltage  decrease  at  the 
PWR  line.  This  intermediate  voltage  will  cause  the 


succeeding  inverting  buffer  to  draw  s  very  large  current 
from  its  power  supply.  This  larse  leakage  current  can  be 
detected  by  a  current  monitor.  Similarly,  by  stressing  the 
voltage  level  at  the  GND  line,  a  stuck-on  fault  at  any 
blocking  FET  Nb  can  be  detected. 

4  SUMMARY  AND  CONCLUSIONS 

Many  ATPGs  use  a  switch-level  circuit  model  to 
accommodate  CMOS  stuck-open  and  stuck-on  faults. 
However,  the  model's  effectiveness  is  limited.  As  an 
alternative,  this  paper  prorases  a  design  technique  to 
enhance  the  testability  of  CMOS  combinational  circuits. 

This  technique  consists  of  implementing 
combinational  circuits  with  specially  designed  gates 
(SOFT  gates)  and  inserting  an  inverting  buffer  after  every 
SOFT  gate  with  a  non-primary  output.  A  3-pattem  test 
scheme  can  then  be  used  to  detect  the  switch-level  faults 
in  this  circuit  structure.  These  3-pattern  tests  can  be 
generated  by  a  gate-level  ATPG  for  stuck-at  faults  and  they 
cannot  be  invalidated  by  stray  circuit  delays. 
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